Nigerian SMEs: Navigating Employee Data Collection Under the NDPA

For Nigerian Small and Medium-sized Enterprises (SMEs), effective human resource management often involves collecting and processing a wide range of employee data. From recruitment forms and payroll details to performance reviews and health information, this data is crucial for operational efficiency. However, in an era of heightened data privacy awareness and strict regulations like the Nigeria Data Protection Act (NDPA), simply collecting data is no longer enough. SMEs must understand their obligations to ensure lawful, fair, and secure handling of this sensitive information. Failing to do so can lead to significant penalties, reputational damage, and a breakdown of trust with your most valuable asset: your employees.

The NDPA: Your Mandate for Employee Data Protection

The Nigeria Data Protection Act (NDPA) 2023 sets the legal framework for data protection in Nigeria, making it mandatory for all organisations, including SMEs, to comply when processing personal data. Employee data, by its very nature, falls squarely under the definition of personal data as it can identify an individual. This includes names, addresses, phone numbers, bank details, educational qualifications, employment history, and even IP addresses if linked to an individual.

Under the NDPA, organisations are considered Data Controllers and/or Data Processors, with specific responsibilities. Key among these are the data processing principles: data must be processed lawfully, fairly, and transparently; collected for specified, explicit, and legitimate purposes; adequate, relevant, and limited to what is necessary; accurate and kept up to date; retained only as long as necessary; and processed in a manner that ensures appropriate security.

Understanding these principles is the first step towards building a Best Practices framework for handling employee data within your SME. Non-compliance is not an option; it’s a legal necessity that protects both your business and your employees.

Establishing a Lawful Basis for Collecting Employee Data

Before you collect any piece of employee data, you must identify a lawful basis for doing so, as stipulated by the NDPA. This is a foundational aspect of Compliance. Here are the most relevant lawful bases for SMEs when dealing with employee information:

• Performance of a Contract: This is arguably the most common basis. You can process data necessary for the performance of an employment contract with your employee. This includes payroll information, contact details for work-related communication, and data required for managing benefits or leave.
• Legal Obligation: Many types of employee data must be collected to comply with legal obligations. Examples include tax information (TIN), social security contributions (PENCOM), or data required by labour laws. If a law mandates the collection, storage, or disclosure of specific data, you have a legal basis.
• Legitimate Interests: Your SME might have legitimate interests in processing certain employee data, provided these interests are balanced against the employee’s fundamental rights and freedoms. For instance, data for monitoring employee performance or for security purposes (e.g., CCTV footage in the workplace) might fall under legitimate interests. However, a strict balancing test is required, and employees must be informed.
• Consent: While tempting, relying solely on consent for employee data collection can be problematic due to the inherent power imbalance in the employer-employee relationship. Consent must be freely given, specific, informed, and unambiguous. It’s challenging to prove that an employee freely consented if they fear adverse consequences for refusing. Therefore, consent should generally be a last resort, or used for specific, non-essential data where refusal won’t impact employment.

It’s crucial to document which lawful basis you are relying on for each type of employee data collected. This documentation will be vital if your practices are ever questioned.

Practical Steps for Compliant Employee Data Management

Beyond identifying a lawful basis, Nigerian SMEs need concrete strategies to ensure their employee data collection and processing aligns with the NDPA. Here are practical steps:

1. Data Minimisation: Only Collect What’s Necessary

Avoid collecting data just because you can. Adhere strictly to the principle of data minimisation. For each piece of data, ask: Is this absolutely necessary for the purpose I’ve identified (e.g., fulfilling the contract, legal obligation)? If not, don’t collect it.

2. Provide Clear Privacy Notices

Employees have a right to know how their data is being used. Provide clear, concise, and easily accessible privacy notices (sometimes called privacy policies or statements) to all employees. These notices should explain:

• What data is collected.
• The purpose of collection.
• The lawful basis for processing.
• Who has access to the data.
• Whether data is shared with third parties (e.g., payroll providers).
• How long the data will be retained.
• Employee’s data subject rights (access, rectification, erasure, etc.).
• Contact details of your designated data protection officer (if applicable) or responsible person.

3. Implement Robust Security Measures

Protecting employee data from unauthorised access, loss, or damage is paramount. This includes:

• Physical Security: Lock filing cabinets, secure offices.
• Technical Security: Use strong passwords, encryption for sensitive digital files, secure networks, firewalls, and up-to-date antivirus software.
• Organisational Security: Restrict access to employee data to only those who strictly need it for their job functions. Implement regular staff training on Data Protection principles and cybersecurity awareness.

4. Respect Data Subject Rights

Employees, as data subjects, have rights concerning their personal data. SMEs must have processes in place to handle requests such as:

• Right to Access: Employees can request to see what data you hold about them.
• Right to Rectification: They can ask for inaccurate data to be corrected.
• Right to Erasure: In certain circumstances, they can request their data be deleted.

Respond to these requests promptly and transparently, usually within one month.

5. Data Retention Policies

Don’t keep employee data indefinitely. Establish clear data retention policies that specify how long different types of data will be kept, based on legal, contractual, or business requirements. Once the retention period expires, securely dispose of the data.

Conclusion

The collection of employee data is an essential part of running any Nigerian SME, but it must be approached with diligence and a strong commitment to privacy. By understanding the NDPA, establishing clear lawful bases for processing, and implementing robust data minimisation, security, and transparency measures, your business can build trust with its employees, enhance its reputation, and avoid the pitfalls of non-compliance. Prioritise data protection from the outset; it’s an investment in your people and the future of your business.